Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers

FortiGuard Labs observed a Casbaneiro malware campaign in August 2026 targeting Latin American users via phishing PDFs and HTA/AutoIt-based multi-stage delivery; the malware performs email and credential theft, uses process injection and persistence via Startup LNK and markers under %PUBLIC%/%APPDATA%, employs targeted C2 activation when victims visit banking sites, and leverages stealthy network behaviors (403 responses, malformed HTTP packets) to evade analysis; the report includes detailed IOCs (hashes, domains, IPs), mitigations, and Fortinet detection names.